It wasn't really an optimization, it scanned all collated scopes here, then if all validated, it avoid *re* checking individual ones.
Now, as it's stepping through the iterator, it checks them just once. NB: it's not doing actual authorization at that stage, just checking the pre-fetched (by authorizeEx) authentication settings.